Xin Long b86a5ccda5 tipc: purge deferredq list for each grp member in tipc_group_delete ...

[ Upstream commit 5cf02612b3 ]

Syzbot reported a memleak caused by grp members' deferredq list not
purged when the grp is be deleted.

The issue occurs when more(msg_grp_bc_seqno(hdr), m->bc_rcv_nxt) in
tipc_group_filter_msg() and the skb will stay in deferredq.

So fix it by calling __skb_queue_purge for each member's deferredq
in tipc_group_delete() when a tipc sk leaves the grp.

Fixes: b87a5ea31c ("tipc: guarantee group unicast doesn't bypass group broadcast")
Reported-by: syzbot+78fbe679c8ca8d264a8d@syzkaller.appspotmail.com
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Ying Xue <ying.xue@windriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2019-06-22 08:15:14 +02:00

..

addr.c

tipc: handle collisions of 32-bit node address hash values

2018-03-23 13:12:18 -04:00

addr.h

tipc: add 128-bit node identifier

2018-03-23 13:12:18 -04:00

bcast.c

tipc: correct spelling errors for struct tipc_bc_base's comment

2018-09-03 22:03:07 -07:00

bcast.h

tipc: make replicast a user selectable option

2017-01-20 12:10:17 -05:00

bearer.c

tipc: fix a double free in tipc_enable_bearer()

2019-01-09 17:38:34 +01:00

bearer.h

tipc: implement configuration of UDP media MTU

2018-04-20 11:04:05 -04:00

core.c

tipc: fix modprobe tipc failed after switch order of device registration

2019-06-04 08:02:34 +02:00

core.h

tipc: replace name table service range array with rb tree

2018-03-31 22:19:52 -04:00

diag.c

tipc: switch to rhashtable iterator

2018-08-29 18:04:54 -07:00

discover.c

tipc: fix lockdep warning when reinitilaizing sockets

2018-11-23 08:17:03 +01:00

discover.h

tipc: some cleanups in the file discover.c

2018-03-23 13:12:17 -04:00

eth_media.c

tipc: make media address offset a common define

2015-02-27 18:18:48 -05:00

group.c

tipc: purge deferredq list for each grp member in tipc_group_delete

2019-06-22 08:15:14 +02:00

group.h

tipc: extend sock diag for group communication

2018-06-30 21:05:42 +09:00

ib_media.c

tipc: rename media/msg related definitions

2015-02-27 18:18:48 -05:00

Kconfig

tipc: implement socket diagnostics for AF_TIPC

2018-03-22 14:43:35 -04:00

link.c

tipc: fix link re-establish failure

2018-11-23 08:17:04 +01:00

link.h

tipc: fix failover problem

2018-09-29 11:45:14 -07:00

Makefile

tipc: implement socket diagnostics for AF_TIPC

2018-03-22 14:43:35 -04:00

monitor.c

tipc: make some functions static

2018-07-21 16:23:22 -07:00

monitor.h

tipc: dump monitor attributes

2016-07-26 14:26:42 -07:00

msg.c

tipc: eliminate buffer cloning in function tipc_msg_extract()

2018-06-30 20:48:16 +09:00

msg.h

tipc: handle collisions of 32-bit node address hash values

2018-03-23 13:12:18 -04:00

name_distr.c

tipc: fix unsafe rcu locking when accessing publication list

2018-10-15 22:33:27 -07:00

name_distr.h

tipc: permit overlapping service ranges in name table

2018-03-31 22:19:52 -04:00

name_table.c

tipc: missing entries in name table of publications

2019-04-27 09:36:31 +02:00

name_table.h

tipc: fix the big/little endian issue in tipc_dest

2018-08-27 15:23:31 -07:00

net.c

tipc: change to check tipc_own_id to return in tipc_net_stop

2019-04-03 06:26:18 +02:00

net.h

tipc: fix lockdep warning when reinitilaizing sockets

2018-11-23 08:17:03 +01:00

netlink_compat.c

tipc: check link name with right length in tipc_nl_compat_link_set

2019-05-02 09:58:57 +02:00

netlink.c

tipc: switch to rhashtable iterator

2018-08-29 18:04:54 -07:00

netlink.h

tipc: make cluster size threshold for monitoring configurable

2016-07-26 14:26:42 -07:00

node.c

tipc: fix node keep alive interval calculation

2019-02-12 19:47:06 +01:00

node.h

tipc: add sequence number check for link STATE messages

2018-07-11 23:06:14 -07:00

socket.c

tipc: fix hanging clients using poll with EPOLLOUT flag

2019-05-16 19:41:31 +02:00

socket.h

tipc: call start and done ops directly in __tipc_nl_compat_dumpit()

2018-09-06 21:49:18 -07:00

subscr.c

tipc: fix unbalanced reference counter

2018-04-12 21:46:10 -04:00

subscr.h

tipc: fix modprobe tipc failed after switch order of device registration

2019-06-04 08:02:34 +02:00

sysctl.c

tipc: add name distributor resiliency queue

2014-09-01 17:51:48 -07:00

topsrv.c

tipc: fix modprobe tipc failed after switch order of device registration

2019-06-04 08:02:34 +02:00

topsrv.h

tipc: rename tipc_server to tipc_topsrv

2018-02-16 15:26:34 -05:00

udp_media.c

tipc: fix a double kfree_skb()

2019-01-09 17:38:34 +01:00

udp_media.h

tipc: implement configuration of UDP media MTU

2018-04-20 11:04:05 -04:00